Anthony Kraudelt<p>My son is 12-year old son is creating an online game and asked "why do users have to login to be on the game's leaderboard." This prompted a discussion about how authentication and authorization are often confused and how they play distinct yet complementary roles in protecting each players games scores for his website. I explained the two as follows:</p><p>Authentication (AuthN) asks the question "Are you who you say you are?" It verifies an identity using credentials like passwords, biometrics, or MFA.</p><p>Authorization (AuthZ) asks "What are you allowed to do?" It determines what actions, or resources, you have access to after authentication.</p><p>You authenticate first (prove your identity), then get authorized (granted permissions). Without both, security is incomplete. The two concepts work in concert to prevent unauthorized system access or data tampering. </p><p>I know that probably wasn't the coolest conversation between a father and son, but his gaming site now has a user login page. :)</p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Authentication</span></a> <a href="https://infosec.exchange/tags/Authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Authorization</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ZeroTrust</span></a></p>